Wekan’s export to Excel route suffered from a broken asynchronous authorization check. The canExport guard was called without awaiting its promise, causing the function to proceed regardless of the user’s permissions. As a consequence, any authenticated account that was not a member of a private board could download a full Excel dump of that board, exposing card titles, descriptions, lists, swimlanes, members, and other sensitive metadata. This flaw permits unauthorized data disclosure in line with CWE‑639.

The vulnerability affects the open‑source kanban application Wekan version 9.57 through 9.74. The official fix was introduced in release v9.74, which correctly awaits the authorization guard. Administrators should verify that their environment is running a patched version or later.

The CVSS score of 6.5 reflects moderate severity. No EPSS data is available, and the vulnerability is not in CISA KEV. Because any authenticated, non-member user can trigger the export, the exploit requires only valid credentials and no special privileges. An attacker can therefore obtain full private board data with minimal effort, making the risk significant for organizations that rely on secret boards.